NetScaler ADC & Gateway HTTP/2 memory-leak denial-of-service

#!/usr/bin/env bash
# noisgate: CVE-2026-13474 NetScaler HTTP/2 memory-leak DoS check
# Usage: ./check_cve_2026_13474.sh <NSIP>
set -u
NSIP="${1:-}"
if [[ -z "$NSIP" ]]; then echo "Usage: $0 <NSIP>"; exit 2; fi

SSH_OPTS=(-o StrictHostKeyChecking=no -o ConnectTimeout=8 -o BatchMode=yes)

# 1. Grab firmware version
VER=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" 'show version' 2>/dev/null \
      | grep -oE 'NS[0-9]+\.[0-9]+: Build [0-9]+\.[0-9]+' \
      | head -1)
if [[ -z "$VER" ]]; then echo "UNKNOWN: cannot retrieve version from $NSIP"; exit 3; fi
echo "Detected: $VER"

# 2. Parse major.minor.build
MAJOR=$(echo "$VER" | grep -oE 'NS[0-9]+\.[0-9]+' | tr -d 'NS')
BUILD=$(echo "$VER" | grep -oE 'Build [0-9]+\.[0-9]+' | awk '{print $2}')

vuln=0
case "$MAJOR" in
  14.1)  awk "BEGIN{exit !($BUILD < 72.61)}" && vuln=1 ;;
  13.1)  awk "BEGIN{exit !($BUILD < 63.18)}" && vuln=1 ;;
  13.0|12.1) vuln=1 ;; # EOL, no fix
  *)     echo "UNKNOWN: unrecognized branch $MAJOR"; exit 3 ;;
esac

# 3. Check HTTP/2 enabled profiles bound to vservers
H2_PROFILES=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" \
  'show ns httpProfile' 2>/dev/null | awk '/Name:/{n=$2} /HTTP2:.*ENABLED/{print n}')

if [[ $vuln -eq 1 && -n "$H2_PROFILES" ]]; then
  echo "VULNERABLE: build $MAJOR-$BUILD < patched, HTTP/2 enabled on: $H2_PROFILES"
  exit 1
elif [[ $vuln -eq 1 ]]; then
  echo "VULNERABLE: build $MAJOR-$BUILD < patched (no HTTP/2 profiles seen; still upgrade)"
  exit 1
elif [[ -n "$H2_PROFILES" ]]; then
  # Patched build but verify Http2SmallWndTimeout mitigation
  BAD=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" 'show ns httpProfile' 2>/dev/null \
        | awk '/Name:/{n=$2} /Http2SmallWndTimeout:.*0 /{print n}')
  if [[ -n "$BAD" ]]; then
    echo "PATCHED but MISCONFIGURED: Http2SmallWndTimeout=0 on: $BAD"
    exit 1
  fi
  echo "PATCHED: build $MAJOR-$BUILD and Http2SmallWndTimeout set"
  exit 0
else
  echo "PATCHED: build $MAJOR-$BUILD (HTTP/2 not enabled)"
  exit 0
fi